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Quantum cryptography and quantum key dis- 
tribution (QKD) have been the most success- 
ful applications of quantum information process- 
ing, highlighting the unique capability of quan- 
tum mechanics, through the no-cloning theo- 
rem, to protect the security of shared encryp- 
tion keys. Here we present a new and fundamen- 
tally different approach to high- capacity, high- 
efficiency QKD by exploiting interplay between 
cross-disciplinary ideas from quantum informa- 
tion and light scattering of aperiodic photonic 
media. The novelty of the proposed approach re- 
lies on a unique type of entangled-photon source 
and a new physical mechanism for efficiently shar- 
ing keys. The new source produces entangled 
photons with orbital angular momenta (OAM) 
randomly distributed among Fibonacci numbers. 
Combining entanglement with the mathematical 
properties of Fibonacci sequences leads to a new 
QKD protocol. This Fibonacci protocol is im- 
mune to photon-number-splitting attacks and al- 
lows secure generation of long keys from few pho- 
tons. Unlike other protocols, reference frame 
alignment and active modulation of production 
and detection bases are unnecessary, since secu- 
rity does not require use of non-orthogonal polar- 
ization measurements. 

Much recent work in QKD has shifted from use of two- 
dimensional polarization spaces to larger Hilbert spaces. 
Coding capacity and security increase with the size of the 
Hilbert space, and with the number of mutually unbi- 
ased bases used for security checkJl^. The most promis- 
ing way to achieve larger Hilbert spaces is via optical 
OAM 6 7 . However, the only practical way to produce 
entangled OAM states is with spontaneous parametric 
down conversion (SPDC), in which production ampli- 
tudes drop off rapidly with increasing OAM. In addition, 
eavesdropper detection in standard protocols requires ac- 
tive modulation of production and detection bases, slow- 
ing key generation rates exponentially as the range of 
OAM values increases. 

Wavefront engineering of light traditionally relies 
on gradual phase shifts accumulated along optical 
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beam paths. Recently, optical beams carrying sin- 
gle OAM states have been realized using planar plas- 
monic interfaces^. Additionally, distinctive scattering 
resonances carrying OAM have been demonstrated in 
nanoplasmonic Vogel spiral arrays^, and the Vogel spi- 
ral geometry has been shown to support multifrac- 
tal photonic band gaps with bandedge modes carrying 
multiple OAM values distributed among the Fibonacci 
numbers' ^ l 11 !. It has been analytically demonstrated that 
Vogel spiral arrays can generate multiple OAM states 
encoding well-defined numerical sequences in their far- 
field radiation patterns^. In the case of golden an- 
gle (GA) spirals, the generated states carry OAM that 
follow the Fibonacci sequence. (Recall that the Fi- 
bonacci sequence^ obeys the recursion relation F n — 
F n -i + F„_2, with initial values F\ = 1 and F2 = 2.) 

Here, we combine GA spiral arrays with SPDC in a 
nonlinear crystal to engineer a new type of entangled 
light source, producing photon pairs whose OAM values 
always sum to a Fibonacci number, allowing efficient pro- 
duction of states with large OAM values with properties 
that can be exploited in new ways. We show that these 
special properties of entangled Fibonacci OAM states al- 
low encryption keys with large numbers of digits to be 
generated by much smaller numbers of photons, exceed- 
ing the two bits per photon provided by quantum dense 
coding 14 , while maintaining high security. The approach 
uses entanglement, as in the Ekert protocol^ (though it 
is used in a fundamentally different manner); however 
it requires one of the two legitimate users of the channel 
(Alice) to make her measurement before any opportunity 
for eavesdropping, as in the BB84E3 protocol. 

Entangled Fibonacci spiral source. A Vogel spiral 
is an array of N particles with polar positions (r n ,9 n ) 
given in terms of scaling factor ao and divergence angle 
a by 

r„ = y/na (1) 

O n = na (2) 

An array of point scatterers, as in Figure 1(a), is then 
represented by a density function: 

N 

p(r,6) = ^25{r-Vna Q )5{9-na) (3) 

71=1 

We have previously shown that the Fraunhofer far-field of 
Vogel spirals can be calculated analytically, within scalar 
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FIG. 1: (a) Schematic of GA spiral Fibonacci OAM genera- 
tor, (b) Far-field pattern of GA spiral within a 2° half-angle 
cone for a structure with 2000 particles and ao = 9.28/xm at 
405 nm. (c) Hankel transform of image in b. (d) Sum of c 
over k, with peaks at Fibonacci values. 

diffraction theory, for arbitrary a and acpl In cylindrical 
coordinates, the far-field of a diffracted input beam is 
given bjff^ 

N 

-EocK, v B ) = E ^2 e 327r ^ ao ^ cos( - l, ' ) - na) (4) 

n=l 

where (v r , vg) are the Fourier conjugate variables of (r, 9). 
As seen in Fig. 1(c), Fourier-Hankel analysis of the cal- 
culated far-field radiation pattern (shown in Figure 1(b)) 
is performed to decompose it into radi al and a zimuthal 
components, providing the OAM values^ 12 * 17 !. We see 
in Figure 1(d) that for GA spirals, OAM values are dis- 
cretized in azimuthal numbers following the Fibonacci se- 
quence. This follows directly from the geometrical prop- 
erties of GA spirals encoded in the far-field pattern^ 10 * 12 !. 
Fig. [2] then shows a schematic of our full QKD setup, in 
which the properties of the spiral source lead to a novel 
approach to high capacity QKD. 

New QKD Protocol. In and BB8#Sl proto- 

cols, photon polarization provides digits of a key (assign- 
ing, for example, 1 to horizontal polarization and to ver- 
tical) and also provides security against eavesdropping: 
Alice and Bob each randomly pick one of two complemen- 
tary bases in which to measure the photon polarization, 
keeping only photons for which the bases match. Eaves- 
dropping is detectable by a drop in polarization correla- 
tions. OAM analogs of these protocols work in a similar 
manner, but with increased key generation capacitj®^, 
allowing multiple-digit segments of key to be transmitted 
by a single photon. 

The light coming from the spiral will be in a superpo- 




FIG. 2: Setup for QKD with Fibonacci-valued OAM states. 
A laser interacts with a spiral array (a) , producing intense 
Fibonacci OAM states with I = F n that are used to pump 
the nonlinear crystal (b), producing signal-idler pairs through 
SPDC. The OAM sorters (c) are arranged to only allow pho- 
tons to reach the arrays (Da and Db) of single-photon de- 
tectors if they also are Fibonacci- valued, with OAM F ni and 
F nB . These must add up to the pump value: F n — F ni + F Us ■ 
Only pairs of values F ni and F„ s which are between 1 and 54 
and which sum to F n values between 3 and 89 are kept. 

sition of states with OAM equal to Fibonacci numbers. 
For the new protocol, we choose N consecutive values, 
? = {Fn a ,F na+1 , F no+N -i}, and assign a block of 
binary digits to each so that equal numbers of 0's and l's 
occur. If OAM values in this set are used, each photon 
generates enough digits to encode log 2 N bits of informa- 
tion. Here, we assume N = 8 to illustrate the potential 
for high capacity. For example, the Fibonacci numbers 
from 3 to 89 may be assigned three-digit blocks as follows: 

3 = 000 8 = 010 21 = 100 55 = 110 , , 
5 = 001 13 = 011 34 = 101 89 = 111 W 

Three key digits are then carried by the OAM of a sin- 
gle photon. The values in T must be arranged to be de- 
tected with equal probability; see appendix A. The SPDC 
spiral bandwidth (range of OAM values) must be suffi- 
cient to span the largest gap in J ' . Bandwidths over 40 
have been achieved^, so the values used here are cur- 
rently practical. Greater bandwidths allow larger sets J 7 , 
increasing both information capacity and security. For 
simplicity, we assume that OAM sorterspma on i y a n ow 
positive OAM values to reach the detectors. (Including 
negative values doubles the capacity for the same J 7 ; see 
appendix D.) 

Imagine a photon with OAM in T (take I — F n = 21 
as an example) entering the crystal. The resulting signal 
and idler OAM, k and l s , are not necessarily Fibonacci, 
but the OAM sorters may be arranged to allow only pho- 
tons with OAM in T (U = F ni , l s — F ns ) to register. For 
collinear SPDC (type I or type II) OAM conservation 
implies F ni + F„ s = F„ . The Fibonacci recursion rela- 
tion forces F n . and F ns to be the two Fibonacci numbers 
immediately preceding F n (F n ^2 — 8 and F n _i — 13 in 
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FIG. 3: Possible outcomes (a) for the case where the total 
OAM is I = 21. Neither Alice nor Bob knows the value re- 
ceived by the other; each knows that the two transmitted val- 
ues must be adjacent Fibonacci numbers, but neither knows 
if the other's value is larger or smaller than their own. This 
replaces the ambiguity introduced in standard protocols by 
the nonorthogonality of the possible polarization bases (b), 
where a vector along one axis in the A basis could be mea- 
sured along either axis in the B basis. 



our example). However, which reaches Bob and which 
reaches Alice is undetermined, so there are two possibili- 
ties (Figure [3] (a)). Suppose Bob receives k = 8 and Alice 
receives l a = 13. Then Alice doesn't know if Bob has 8 
or 21 (the Fibonacci value before hers, or the one after). 
Similarly, Bob doesn't know if Alice has 5 or 13. To de- 
termine each other's values, each must send one classical 
(potentially public) bit to the other (see Fig. [3|. They 
then add their values to get the pump value F n = 21, 
which serves as one segment of the key. 

The protocol utilizes two complementary sources of 
ambiguity for secure communication: uncertainty in how 
the OAM Fibonacci state is decomposed between Alice 
and Bob minimizes the amount of information an eaves- 
dropper could obtain from the classical exchange (see ap- 
pendix B), whereas Eve reveals her presence through her 
failure to uniquely identify a particular OAM value in 
the quantum channel due to uncertainty as to which of 
two possible superpositions it originates from (see be- 
low). Detailed security analysis will be conducted else- 
where, but appendix C points out the inherent immunity 
to photon-number-splitting attacks and the possibility of 
a new type of decoy state. 

Detecting eavesdropping. The usual method of 
detecting eavesdroppers employs two (or mor mu- 
tually unbiased bases (Figure [3] (b)). However, in the 
current setting a more novel possibility arises. Pho- 
tons leaving the spiral are in superposition states: 
|^o) = ^FzCnl-^™)- Down conversion splits each |F n ) 
into a state of form |^i) = C\ J2 n 1 \1)a\Fti — 1)b- 
The sorters pick out values I € J 7 , leading to entan- 
gled combinations of consecutive Fibonacci numbers: 

I*) = C 2 En {\Fn-lU\F n -2) B + iK^UI^-lM ■ AS- 
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FIG. 4: Scheme for classical information exchange. Alice first 
sends Bob one bit according to the scheme in the middle row. 
Since Bob knows Alice must have either the Fibonacci num- 
ber before his or the one after, this is sufficient for him to 
deduce her value. Bob then transmits one bit to Alice. To 
minimize Eve's ability to reconstruct the values, Bob uses the 
same scheme Alice did when her value is even (top row), but 
uses the conjugate scheme (O's and l's interchanged) when 
her value is odd (bottom row). Both now know each other's 
values, and can add them to get the value I — F n of the pump, 
but an eavesdropper cannot (see appendix B for more detail) . 
F n then serves as the key segment. 



sume that the entangled photons are created in lab A and 
Alice measures her value immediately, while the other 
photon is still in transit to lab B. 

If Alice measures Ia — 8, the state reaching Bob will 
be a superposition, -\= {|5) b + |13)s} ■ Suppose Eve in- 
tercepts Bob's photon and measures Is = 5. She then 
resends a new photon to Bob in place of the one she 
intercepted. She knows she should transmit a superposi- 
tion, but she must guess which superposition to prepare: 
75 {|5) B + |13)a} or i {\1) B + |5) B }? So when Bob 
makes his measurement, he will find the possible values 
1, 5, or 13, with respective probabilities |, |, and \. 
But, given Alice's measurement of 8, the only values he 
should be receiving are 5 and 13, with probability \ each. 
So the security protocol has Alice and Bob telling each 
other their values for a randomly selected subset: if Eve 
has been at work, 25% of the time they will have val- 
ues which are not adjacent (like 1 and 8 in the example 
above). If no problem appears in the security subset, the 
remaining photons then generate the high capacity key: 
if n photon pairs are left after security checks, Alice and 
Bob share a 3n-digit key. Generalizing from three-digit 
segments per photon to longer segments involving larger 
F n , is obvious. 

Advantages. Besides increased capacity per photon, 
the Fibonacci protocol has several advantages: (i) In- 
tercepting one of the photons by itself does not allow 
Eve to determine that key segment, since each photon 
only carries half the information needed to reconstruct 
the key. (ii) Carried out in free space, irrelevant pho- 
tons coming from the ambient light tend to be automat- 
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ically screened out, since only photons with Fibonacci- 
valued OAM contribute, (iii) Randomized OAM values 
are produced in a completely passive manner, without 
need for active switching of holograms, as required by 
other OAM-based QKD approaches, greatly speeding up 
key generation rates, (iv) The Fibonacci numbers have 
gaps between them, reducing misattribution errors, (v) 
Fibonacci coding can be more efficient than binary cod- 
ing for some purposed^, (vi) Unlike in polarization-based 
QKD, no alignment of reference frames is needed, (vii) 
The procedure is, in principle, highly scalable: to use at 
longer distances, the crystal may be pumped at higher 
intensity and the alphabet of Fibonacci numbers T can 
be increased in size, allowing the same rate of key genera- 
tion despite increased losses. The use of multiple parallel 
detectors reduces speed limitations on the detection side. 

One disadvantage is that the classical exchange in- 
cludes information about the actual key (not just about 
measurement bases, as in other protocols). If Eve inter- 
cepts it, she can narrow possibilities for each three-digit 
segment from 8 down to three or four (appendix B). She 
cannot determine the value uniquely, but preventing Eve 
from obtaining any information about the key at all is 
highly desirable. A variation of the protocol which elim- 
inates this weakness is in fact possible, at the cost of 
increased complexity; a description of this is in prepara- 
tion. 

Finally, the protocol depends only on the recurrence 
relation, not on the starting values of the sequence. So 
an identical protocol exists, for example, for the Lucas 
sequence^. More generally, other two-term recursion re- 
lations may also be used. 

We have demonstrated a new realization of high- 
capacity, high-efficiency quantum cryptography, based on 
specially engineered OAM-entangled states of light and 
a new QKD protocol exploiting recursive properties of 
the Fibonacci sequence. We believe this approach is gen- 
eral enough to lead to novel QKD implementations us- 
ing other physical variables, such as encoding Fibonacci 
numbers in phase. 



Appendix A: Equalization of probabilities 

If some of the values in the chosen set of Fibonacci 
numbers are more likely than others to contribute to the 
key, this bias provides a loophole that the eavesdropper 
can use to compromise security. Since neither the golden 
angle spiral nor the down conversion process have flat dis- 
tributions in the space of angular momentum values, we 
must somehow equalize the probabilities of the F n values 
detected. This can be done in several ways. First, by ap- 
propriately engineering the spiral source and altering the 
distance of the spiral from the down conversion crystal, 
there is a measure of control over the spectrum that in 
principle can be used to flatten the OAM spectrum. How- 
ever, a simpler solution is simply to insert filters in the 
apparatus. Filters can be designed that allow some angu- 



lar momenta to pass with higher probability than others, 
and so these can be used to compensate for the distribu- 
tion in the signal and idler beam after the crystal. A still 
simpler solution is to place filters before the detectors. 
The sorters convert different angular momentum values 
into different spatial locations, so a filter of appropriate 
transmission probability can be placed at each position. 
This last possibility has at least two additional advan- 
tages: (i) Each filter need only be chosen to transmit a 
particular proportion of the total intensity; its transmis- 
sion profile does not need to be OAM-dependent. (ii) 
This adds an additional contribution to security, since 
even when Eve intercepts a photon and resends a copy, 
she does not know if the one she sends will be one of 
those that survive the filtering process at the end, thus 
essentially adding noise to Eve's signal, but not to Alice's 
or Bob's. This reduces her effective eavesdropping rate. 



Appendix B: Security from eavesdropping 

In the main text, a scheme is described in which Alice 
and Bob exchange one bit each of classical information 
in order to determine each other's values. They then 
add the two values together to get the orbital angular 
momentum I = F n of the pump, and that total value 
serves as a segment of the key. Here we point out that 
for an eavesdropper listening in on the classical channel, 
the information exchanged is insufficient to determine the 
value. Using the procedure that was outlined, each clas- 
sical exchange leads to ambiguous results for Eve: 



Eve sees: 


00 


01 


10 


I could be: 


3,21,34,89 


3,5,13,21 


8,55,89 



(Al) 

(In the top row, the first digit in each pair is the classi- 
cal bit sent by Alice, the second is the bit sent by Bob.) 
Note that each I value except 8 can be represented by 
two different classical exchanges, and that each exchange 
can represent three or four different I values: if Eve in- 
tercepts the classical exchange, she has a probability of 
only | to | of correctly guessing the value of F n , with 
the average probability of a correct guess being 27.08%. 
The probability of a correct guess drops as the number 
N of Fibonacci values used increases. Alice and Bob can 
determine each other's values, while Eve cannot. This is 
possible only because of the combined action of (i) the 
entanglement and (ii) the properties of the Fibonacci re- 
cursion relation. 

Because of the different nature of the ambiguity in 
the Fibonacci QKD protocol, a strong-light analog of 
the proposed approach could be devised. A computer 
could be programmed to randomly change settings on 
a pair of spatial light modulators or other device in or- 
der to encode pairs of adjacent Fibonacci values on the 
OAM content of two strong Gaussian pulses (with all the 
photons in each pulse being in the same OAM state). 
The ambiguity in who has the higher of the two values 
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in the Fibonacci number decomposition allows the ran- 
dom key to be shared in the same manner as before. 
Eve would still not be able to obtain significant infor- 
mation about the key from the public exchange between 
Alice and Bob. However, if Eve now intercepts the OAM 
state sent to Bob (on what was previously the quantum, 
single-photon channel), the eavesdropping can no longer 
be revealed, since Eve may now siphon off multiple pho- 
tons from the beam to reconstruct its state exactly with- 
out changing the state of the remaining beam. In other 
words, secure key generation with minimal information 
leakage through the public exchange can be performed 
with Gaussian states by exploiting Fibonacci recurrence, 
but the confident detection of an in-line eavesdropper's 
presence would require the quantum regime. So this 
Gaussian-state version of the Fibonacci protocol could 
overcome distance limitations inherent in quantum cryp- 
tography, but at the cost of losing the security gained 
from the ability to reveal eavesdroppers. In exchange, 
the high transmission rate of the Gaussian state proto- 
col would allow for sufficient privacy amplification to be 
implemented in order to bring the information available 
to Eve back down to a very low level, allowing overall 
security to be maintained. 



Appendix C: Photon-splitting attacks, decoy states, 
and security 



the setup. When the pump photon of OAM F n pro- 
duces the down conversion pair with OAM U and l s , 
angular momentum conservation requires F n = 1^ + l s . 
The bits used to construct the key come from the in- 
stances in which this is satisfied by the outgoing angular 
momenta equalling the two previous Fibonacci numbers: 
F n = F n _i + F n _2- However, the conservation relation 
can also be satisfied by values of U and l s , neither of 
which are Fibonacci (for example: 13 = 9 + 4, in which 
13 is Fibonacci but 4 and 9 are not), or in instances 
where one of the outgoing values is a Fibonacci num- 
ber while the other is not (for example, 13 = 3 + 10, in 
which 13 and 3 are Fibonacci, while 10 is not). Consider 
the latter case, i.e. F n — F m + I, where m < n — 3 
and I is not Fibonacci. If Eve detects the Fibonacci 
value F m on its way to Bob, she has no way of know- 
ing that Alice's number is not Fibonacci, so she will send 
Bob one of the two superpositions {\F m ) + \F m -i)) or 

(\F m ) + \F m +i))- However, after measurements are 
completed, Alice and Bob can exchange information let- 
ting each other know for which photons they received Fi- 
bonacci or non-Fibonacci values. If Alice measures non- 
Fibonacci value \l), then the state arriving in Bob's lab 
should be h= ^2 n \F n — I). All but one of the terms in 
this sum will be non-Fibonacci-valued, with the excep- 
tion being the term where F„ — I = F m . Suppose Bob 
compares the state he receives to a test state of the form 



In QKD, the goal is always to send single photons, but 
in reality what are sent are attenuated pulses with mean 
photon number less than one. There will always be some 
pulses containing more than one photon each. In some 
standard protocols, such as BB84, all of the photons in 
the same pulse undergo the same preparation (passing 
through the same polarizer or same hologram), so they 
come out with the same polarization or the same OAM. 
This leads to a serious security problenPSIH] Splitting 
off one photon from each pulse, Eve can measure its state 
without altering the state of the remaining photons. She 
sends the remainder of the pulse on to Bob via a channel 
of lower loss than the original one, in order to mask the 
fact that she has removed some of the photons. Mea- 
sures must be taken to safeguard against such photon- 
number splitting attacks, for example by insertion of de- 
coy states^. 

However, in the Fibonacci protocol, the situation is 
different. If a multiphoton pulse is sent into the spiral 
source, there is no reason for the photons that come out 
to be in the same state: they will be distributed among 
the different Fibonacci numbers in the same manner as 
they would if they had been sent in one by one. Siphon- 
ing off one photon from a pulse will tell the eavesdrop- 
per nothing about the state of the other photons in that 
pulse. So, the Fibonacci protocol is intrinsically immune 
to photon-number splitting attacks. 

Security can be further enhanced by using a new type 
of decoy state that is already present automatically in 



latest) = -^{\F no )-\F no+1 ) + \F no+2 ) (Al) 
-\F n +a) H ± \F no +N-i)} , 

with alternating signs between terms. This state has 
nonzero inner product with each individual Fibonacci 
state, but is orthogonal to all pairwise superpositions of 
consecutive Fibonacci states. So, when Alice receives 
a non-Fibonacci number, Bob should expect the inner 
product between his state and the test state to be — j= 
(due to the F m term in the sum), whereas if Eve has 
tampered with the state he will instead find the overlap 
to be equal to zero. Bob will once again be able to detect 
Eve's interference through a large (ideally 100%) drop in 
his detection rate for the subset of events where Alice 
receives non-Fibonacci values. 

Instead of intercept-and-resend or photon-number- 
splitting attackes, Eve may instead try to clone the state 
and then send one copy on, keeping the other to mea- 
sure after intercepting the classical exchange. This, how- 
ever runs afoul of the no-cloning theorerrpll she can only 
make perfect clones if the possible states are mutually 
orthogonal and if she knows what they are. Since the su- 
perpositions Eve intercepts are not mutually orthogonal, 
detectable errors will again be introduced. 

A more detailed analysis of security issues in the Fi- 
bonacci protocol will appear elsewhere. 
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FIG. A5: A variation of fig. 1 that makes use of both positive 
and negative orbital angular momentum values to double key 
generation capacity. Rather than keeping only positive values, 
both signs are kept. Alice and Bob must exchange classical 
information to tell each other the signs of each detection. 



Appendix D: Doubling the information capacity 

In the main text, we assumed that only positive orbital 
angular momentum (OAM) values were used, in order to 
keep the explanation relatively simple. The OAM sorters 
before the detectors in fig. 1 of the main text allow us 
to divert negative OAM values away from the detectors, 
keeping only positive signal and idler values. This in 
turn implies that only positive-OAM pump photons con- 
tribute. 

However, negative OAM values are also created by the 
source, at the same rate as the positive values. It is 
to our advantage to expand the setup to make use of 
these, rather than letting half of the created photons go 
to waste. When we do this, we find that the number of 



bits of key generation per photon can be doubled. 

A schematic of the expanded setup is shown in fig. |A5| 
Alice and Bob count their positive and negative angular 
momentum values separately, and during the classical ex- 
change let each other know the signs they received. They 
then only keep the trials on which they received the same 
signs. (This is in a sense analogous to keeping only the 
sets of matching bases in the BB84 and E91 protocols.) 
Each positive or negative Fibonacci number can then rep- 
resent a four-digit binary string: 



I 


Binary string 


I 


Binary string 


3 


0000 


-3 


1000 


5 


0001 


-5 


1001 


8 


0010 


-8 


1010 


13 


0011 


-13 


1011 


21 


0100 


-21 


1100 


34 


0101 


-34 


1101 


55 


0110 


-55 


1110 


89 


0111 


-89 


1111 



So we now have 16 possible outcomes for the key seg- 
ment, with each segment capable of encoding 4 bits of 
information via a single photon. 
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